We run the white-box PGD attack [1]} on the models trained by standard softmax, JEM and GMMC. We use the same number of steps (40) with different \(\epsilon \) 's as the settings of JEM for PGD. Table REF  reports the test accuracies of different methods. It can be observed that GMMC achieves much higher accuracies than standard softmax and JEM under all different attack strengths. The superior defense performance of GMMC (Dis) over JEM mainly attributes to the MMC modeling [2]}, while GMMC (Gen) further improves its robustness over GMMC (Dis) due to the generative training.
